A critical flaw in PrefectHQ's Prefab UI, tracked as CVE-2026-120338 and scored 10.0, allowed code submitted to its Generative UI sandbox to read and write files on the host server. Users should upgrade to version 0.21.0 or later.

What went wrong

Prefab UI's Generative UI feature runs code supplied by a caller — often written by a language model — inside Pyodide, a version of Python compiled to WebAssembly, within a Deno subprocess. That sandbox was supposed to isolate untrusted code. According to the disclosure published on 1 November, it did not. The launcher started Deno with unrestricted read, write and network permissions, and left the Deno programming interface exposed on the JavaScript global object. Python code could therefore reach through to the host and read or write server files, turning a supposedly contained sandbox into a route to persistent code execution.

Who is affected

Versions 0.14.0 through 0.20.2 are affected. The maximum 10.0 score applies to a specific, realistic setup: a FastMCP server with Generative UI enabled, Deno installed, and no authentication configured, where any reachable client can submit code. Where authentication is present, an authorised client that can call the tool is still affected, scored at 9.9. The feature is opt-in, so only deployments that enabled Generative UI are exposed — but teams should not rely on Deno being absent, since FastMCP documentation says it installs automatically on first use.

What to do now

Version 0.21.0, released on 26 October before the CVE was published, fixes the flaw, with 0.21.1 following the same day. The fix revokes Deno's read, write and network permissions before any submitted code runs, starts the process so permissions cannot be prompted back, and limits bootstrap network access to cdn.jsdelivr.net. No exploitation in the wild had been reported at disclosure, and the flaw is not listed in CISA's known-exploited catalogue — but the fix was already available before disclosure, so there is no reason to delay upgrading. Sources: GitHub security advisory GHSA-595q-jv4r-q7j9 and CVE record CVE-2026-120338.